'Dirty Frag' Linux flaw one-ups CopyFail with no patches and public root exploit

"“As with the previous Copy Fail vulnerability, Dirty Frag likewise allows immediate root privilege escalation on all major distributions,” Kim said. “Because the responsible disclosure schedule and embargo have been broken, no patches exist for any distribution.”"

"“Dirty Frag works by chaining together two separate Linux kernel flaws. One sits in the xfrm-ESP subsystem and dates back to a January 2017 kernel commit, according to Kim, while the second vulnerability affects RxRPC functionality introduced in 2023.”"

"“Together, the two bugs allegedly let unprivileged local users overwrite protected files in memory and claw their way to root. A long list of distributions in the firing line, according to Kim, including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, Fedora, AlmaLinux, and openSUSE Tumbleweed.”"

"“Separately, researchers appear to have independently reverse-engineered part of the bug chain from a publicly visible kernel fix commit before the embargo expired, adding to the disclosure mess already surrounding the flaw. One GitHub project titled ‘Copy Fail 2: Electric Boogaloo’ claims to weaponize the ESP/xfrm side of the issue separately from Kim's full Dirty Frag chain.”"

Dirty Frag is a local privilege escalation vulnerability affecting all major Linux distributions. It enables unprivileged local users to overwrite protected files in memory and gain immediate root privileges. The flaw chains two separate kernel issues: one in the xfrm-ESP subsystem dating to a January 2017 kernel commit, and another affecting RxRPC functionality introduced in 2023. The disclosure process was disrupted by a broken embargo, leaving no patches and no CVE available for any distribution. Reported targets include Ubuntu, Red Hat Enterprise Linux, CentOS Stream, Fedora, AlmaLinux, and openSUSE Tumbleweed. Public exploit availability and independent reverse engineering of parts of the chain increased exposure.

Read at theregister